docs: def decrypt_yubikey_otp(self, from_key):
          """
          Try to decrypt a YubiKey OTP.
  
          Returns a string starting with either 'OK' or 'ERR' :
  
          'OK counter=ab12 low=dd34 high=2a use=0a'
  
          'ERR Unknown public_id'
  
          on YubiHSM errors (or bad OTP), only 'ERR' is returned.
          """
          if not re.match(valid_input_from_key, from_key):
              self.log_error("IN: %s, Invalid OTP" % (from_key))
              if self.stats_url:
                  stats['invalid'] += 1
              return "ERR Invalid OTP"
  
          public_id, _otp = pyhsm.yubikey.split_id_otp(from_key)
  
          try:
              aead = self.aead_backend.load_aead(public_id)
          except Exception as e:
              self.log_error(str(e))
              if self.stats_url:
                  stats['no_aead'] += 1
              return "ERR Unknown public_id"
  
          try:
              res = pyhsm.yubikey.validate_yubikey_with_aead(
                  self.hsm, from_key, aead, aead.key_handle)
              # XXX double-check public_id in res, in case BaseHTTPServer suddenly becomes multi-threaded
              # XXX fix use vs session counter confusion
              val_res = "OK counter=%04x low=%04x high=%02x use=%02x" % \
                  (res.use_ctr, res.ts_low, res.ts_high, res.session_ctr)
              if self.stats_url:
                  stats['ok'] += 1
          except pyhsm.exception.YHSM_Error as e:
              self.log_error ("IN: %s, Validate FAILED: %s" % (from_key, str(e)))
              val_res = "ERR"
              if self.stats_url:
                  stats['err'] += 1
  
          self.log_message("SUCCESS OTP %s PT hsm %s", from_key, val_res)
          return val_res